Responsible Vulnerability Disclosure

1. Introduction

The security of our customers, services and information assets is important to SBAB Bank AB (publ) ("SBAB").

We welcome responsible reports from security researchers, customers, partners and members of the public who believe they have identified a security vulnerability affecting SBAB or its services.

This policy explains how suspected vulnerabilities should be reported, which systems may be tested and what limited security research may be conducted without prior individual written authorization.

This policy is not an open penetration testing or bug bounty program. It does not provide general authorization to conduct vulnerability scanning, automated security assessments, systematic vulnerability discovery or other intrusive security testing.

SBAB's objective is to facilitate responsible vulnerability reporting while protecting the availability, integrity and confidentiality of our banking services and customer information.

This policy is governed by, and shall be interpreted in accordance with, Swedish law. It does not establish a contractual relationship, create an entitlement to compensation or grant any authorization beyond the limited security research activities expressly permitted under this policy.

SBAB may amend this policy at any time. Amendments will apply prospectively and will not retroactively revoke authorization applicable to previously compliant research.

2. Reporting a Vulnerability

Please report suspected security vulnerabilities to:

Email: sirt@sbab.se

Sensitive information should be encrypted using the public PGP key referenced in our security.txt file.

Reports may be submitted in English or Swedish.

Anonymous reports are accepted. Providing contact information is encouraged to support clarification, validation and coordinated disclosure but is not required.

Please include sufficient information to help SBAB understand, assess and reproduce the suspected vulnerability, where available:

• Description of the suspected vulnerability.
• Affected application, URL, endpoint or service.
• Steps to reproduce the issue.
• Relevant proof-of-concept information, using redacted or synthetic data where possible.
• Date and time of discovery or testing, including time zone.
• Source IP address or addresses used during testing, where applicable.
• Assessment of potential security impact.
• Information about any unintended exposure of sensitive information.

Please do not include personal data, customer data, credentials, authentication tokens or other sensitive information unless strictly necessary and agreed with SBAB.

Reports indicating active exploitation, significant exposure of sensitive information or an imminent threat to SBAB's services should be clearly marked URGENT in the email subject.

SBAB is responsible for assessing whether reported vulnerabilities or related security incidents trigger applicable legal or regulatory notification obligations, including under the Digital Operational Resilience Act (DORA) or applicable Swedish financial supervisory requirements. Such assessments and notifications are managed by SBAB and are not the responsibility of the reporter.

3. Scope

3.1 Reporting Scope

SBAB accepts reports concerning suspected vulnerabilities that may affect its systems, services, customers or information assets.

Reports may concern:

• Public websites and internet-facing applications.
• Customer-facing applications and services.
• APIs and authentication services.
• SBAB-operated cloud services and infrastructure.
• Other systems operated or controlled by SBAB.
• Third-party or supplier-operated services that may affect SBAB.

While SBAB welcomes vulnerability reports concerning the systems and services listed above, this does not constitute authorization to conduct security testing of all such systems.

Authorized security testing is limited to the scope and conditions defined in Sections 3.2 and 3.3.

3.2 Authorized Testing Scope

Without prior individual written authorization, limited security research is permitted on publicly accessible, internet-facing websites, applications and APIs operated or controlled by SBAB Bank AB (publ), provided that the research complies with the restrictions in this policy.

This authorization applies only to systems for which SBAB has the legal and operational authority to permit security testing.

Authorized activities include limited, low-rate manual exploration of publicly accessible functionality and targeted verification of suspected security vulnerabilities, as described in the Permitted Security Research section.

This policy does not constitute authorization for general penetration testing, vulnerability scanning, automated discovery or other automated security testing techniques.

Systems and environments excluded from authorization are described in the following section.

If you are uncertain whether a system is authorized for testing, you must refrain from testing and contact sirt@sbab.se for clarification or written authorization.

3.3 Systems Not Authorized for Testing

The following systems and environments are excluded from authorized testing under this policy unless SBAB has provided separate written authorization:

• Third-party and supplier-operated services, including outsourced services and critical ICT third-party providers, unless SBAB has expressly authorized their testing.
• External SaaS platforms and services outside SBAB's control.
• Social media platforms.
• Employee devices, corporate endpoints and internal workstations.
• Internal networks and non-public infrastructure.
• Development, staging and test environments.
• Physical security systems and facilities.
• Systems, accounts or information belonging to SBAB customers or other third parties.
• Services or infrastructure for which SBAB does not have the authority to permit security testing.

The presence of SBAB branding, domain names, certificates or integrations does not, by itself, establish that a system is authorized for testing.

If you identify a suspected vulnerability affecting an excluded system or third-party service used by SBAB, please report it to SBAB without performing additional testing.

SBAB may coordinate the report with the relevant supplier or service provider as appropriate.

4. Permitted Security Research

Without prior individual written authorization, researchers may conduct limited, low-rate manual security testing of publicly accessible functionality on systems within the Authorized Testing Scope.

Such testing may include reasonable manual exploration to identify potential vulnerabilities and targeted verification of suspected security weaknesses.

Testing must:

• Be conducted in good faith and with minimal impact on SBAB's systems and services.
• Use only accounts and data owned by the researcher or expressly authorized for testing.
• Avoid excessive requests, service degradation or disruption.
• Avoid unauthorized access to, modification or disclosure of information belonging to others.
• Be limited to the minimum activity reasonably necessary to identify and verify a suspected vulnerability.
• Stop immediately if testing causes unexpected system behavior, service degradation or exposure of sensitive information.
• Stop verification once sufficient evidence of a vulnerability has been obtained.

Limited, low-rate manual exploration of publicly accessible functionality is permitted, provided that it does not result in service degradation, excessive requests or adverse impact on other users.

A small number of automated requests may be used where manual verification is impractical, but only to validate an already identified issue and in accordance with the restrictions in this policy.

Researchers must not expand testing to excluded systems, third-party services or other targets outside the Authorized Testing Scope.

If further testing would require activities beyond these limits, researchers must obtain separate written authorization from SBAB before proceeding.

5. Activities Not Permitted

Unless SBAB has provided separate written authorization, the following activities are prohibited:

• Automated security testing: Automated vulnerability scanning, systematic discovery, fuzzing, enumeration or other automated security testing techniques.
• Disruptive testing: Denial-of-service, stress, load or resource-exhaustion testing, or any activity that could adversely affect service availability or performance.
• Credential attacks: Brute-force attacks, password spraying, credential stuffing or testing using leaked, stolen or third-party credentials.
• Social engineering and physical testing: Phishing, social engineering or physical security testing.
• Malicious activities: Malware deployment, persistence, command-and-control activities or lateral movement.
• Security evasion: Attempts to conceal testing activity, evade security monitoring, bypass rate limits or circumvent security controls beyond the limited verification permitted under this policy.
• Unauthorized access or exploitation: Intentional access to, collection, modification, deletion or disclosure of unauthorized information, or exploitation beyond what is strictly necessary to demonstrate a suspected vulnerability.

Researchers must stop testing once sufficient evidence has been obtained or if SBAB requests that testing cease.

If verification of a suspected vulnerability requires activities beyond these restrictions, researchers must obtain written authorization from SBAB before proceeding.

6. Additional Testing Authorization

Researchers who wish to conduct security testing beyond the limits of this policy may request separate written authorization from SBAB.

Requests should be sent to:

Email: sirt@sbab.se

The request should describe:

• The systems or applications proposed for testing.
• The purpose and expected scope of the testing.
• The intended testing methods and tools, including any automation or AI-based capabilities.
• The expected duration and proposed testing window.
• The source IP addresses and accounts to be used, where applicable.
• Any anticipated risks to availability, confidentiality or integrity.
• The researcher's contact information.

SBAB may approve, restrict or decline such requests at its discretion.

Any authorization must be explicitly granted in writing by an authorized SBAB representative before testing begins.

Written authorization must specify the approved targets, permitted methods, relevant restrictions and authorization period.

A request for authorization does not itself constitute permission to conduct testing.

Testing performed under separate written authorization is subject to the conditions specified in that authorization. Those conditions take precedence over this policy to the extent expressly stated.

7. If You Encounter Sensitive Information

If otherwise permitted testing unexpectedly exposes customer information, personal data, credentials, financial information, internal resources or other confidential information:

1. Stop testing immediately.
2. Do not access or attempt to retrieve any additional confidential information.
3. Do not intentionally copy, download, retain, modify, share or disclose the exposed information.
4. Record only the minimum technical evidence necessary to describe the issue, such as the affected endpoint, timestamp, HTTP status code or a redacted description of the response.
5. Notify sirt@sbab.se promptly, clearly identifying any potentially sensitive exposure.
6. Take reasonable steps within your control to prevent further disclosure.
7. If sensitive information has been inadvertently stored, inform SBAB and coordinate its secure deletion.

Researchers should avoid including actual customer information, credentials, authentication tokens or other confidential content in vulnerability reports.

Where evidence containing sensitive information is strictly necessary, researchers should first contact SBAB to agree on an appropriate secure reporting method.

The unintentional exposure of confidential information during otherwise compliant security research does not, by itself, invalidate Safe Harbor, provided that the researcher promptly stops testing, avoids further unauthorized access and reports the vulnerability in accordance with this policy.

This provision does not authorize intentional access to or collection of confidential information.

8. Vulnerabilities We Would Like Reported

SBAB is particularly interested in vulnerabilities that could materially affect the confidentiality, integrity or availability of its systems or information.

Examples include:

• Authentication and authorization weaknesses.
• Insecure Direct Object References (IDOR) and other access-control failures.
• Broken Object Level Authorization (BOLA).
• Cross-site scripting (XSS).
• Cross-site request forgery (CSRF) with demonstrable security impact.
• Server-side request forgery (SSRF).
• SQL injection and other injection vulnerabilities.
• Remote code execution.
• Sensitive information exposure.
• Security misconfigurations with demonstrable impact.
• Business logic vulnerabilities affecting security or financial integrity.
• Cryptographic weaknesses with demonstrable security impact.
• Session management and authentication token vulnerabilities.

Findings that represent only best-practice improvements or theoretical weaknesses without demonstrable security impact are normally not considered vulnerabilities requiring remediation under this policy.

Examples include:

• Missing security headers without demonstrable security impact.
• Software version disclosure without an applicable exploitable weakness.
• Missing cookie attributes without demonstrable security impact.
• Informational findings generated by automated scanners.
• Speculative vulnerabilities without sufficient supporting evidence.

SBAB may nevertheless review such information where it is relevant to its security posture.

The examples above describe the types of reports SBAB welcomes. They do not expand the Authorized Testing Scope or permit activities otherwise prohibited under this policy.

9. Coordinated Disclosure

SBAB supports coordinated vulnerability disclosure and encourages researchers to report suspected vulnerabilities privately before public disclosure.

Please keep reported vulnerabilities confidential while SBAB investigates and remediates the issue.

SBAB aims to investigate, validate and remediate reported vulnerabilities in a risk-based and timely manner, taking into account their severity, exploitability and potential impact on customers and services.

As a general guideline, researchers are requested to allow approximately 90 calendar days from SBAB's receipt of the initial report before public disclosure.

Where remediation is completed earlier, SBAB and the researcher may coordinate an earlier publication date.

Where a vulnerability remains unresolved after 90 days, SBAB will seek to coordinate disclosure with the researcher, taking into account the vulnerability's severity, the risk of exploitation and the potential impact on customers.

Any extension of the disclosure timeline should be mutually agreed upon.

Researchers are requested not to disclose customer data, credentials, confidential information or technical exploit details that would unnecessarily increase risks to affected systems or individuals.

This disclosure guideline does not establish an unconditional obligation for SBAB to remediate every reported vulnerability within 90 days.

Nor does the expiry of the guideline period authorize further testing, unauthorized access or disclosure of information protected by law.

10. What You Can Expect From Us

For vulnerability reports submitted in accordance with this policy, SBAB aims to:

• Acknowledge receipt within three business days, where contact information is available.
• Review and assess the reported vulnerability.
• Request clarification or additional information where necessary.
• Prioritize reports according to their potential security impact.
• Provide relevant status updates where appropriate.
• Work to validate and remediate legitimate vulnerabilities in a risk-based and timely manner.
• Coordinate disclosure with the researcher where appropriate.
• Treat reporter identities confidentially, subject to applicable legal and regulatory obligations.

Reports indicating active exploitation, imminent threats or significant exposure of sensitive information will be prioritized for urgent assessment.

SBAB may review vulnerability reports regardless of how the vulnerability was discovered. The receipt or review of a report does not imply that the underlying testing was authorized or that Safe Harbor applies.

SBAB may share relevant vulnerability information with affected suppliers, service providers, regulatory authorities or other parties where necessary for investigation, remediation or compliance with legal obligations.

SBAB will seek to minimize unnecessary disclosure of researcher identities and personal information.

This is not a bug bounty program. Financial compensation is not offered.

11. Safe Harbor

SBAB supports good-faith security research conducted in accordance with this policy.

For the purposes of this policy, good-faith security research means activity conducted solely to identify and responsibly report suspected vulnerabilities, without malicious intent, personal gain through unauthorized access or deliberate harm.

SBAB regards limited, good-faith manual security research conducted within the Authorized Testing Scope and in accordance with the Permitted Security Research section as authorized for the purposes expressly described in this policy.

This authorization includes proportionate manual exploration to identify suspected vulnerabilities and limited verification of identified security weaknesses.

Where a researcher acts in good faith, complies with this policy and promptly reports identified vulnerabilities, SBAB will not pursue civil claims solely on the basis of such authorized security research.

SBAB will not request or recommend legal action solely on the basis of research that SBAB has expressly authorized under this policy.

An inadvertent, minor deviation from this policy will be assessed in context, taking into account the researcher's intent, conduct, promptness of reporting and any resulting impact. Such a deviation does not automatically invalidate Safe Harbor. However, this provision does not expand the permitted activities or guarantee protection for conduct outside the policy.

Safe Harbor does not apply to:

• Activities outside the authorized scope or permitted limits of this policy, except where SBAB expressly determines otherwise.
• Deliberate harm, disruption or service degradation.
• Intentional unauthorized access to confidential or third-party information.
• Deliberate collection, retention, modification or disclosure of confidential information.
• Extortion, coercion or demands for payment.
• Attempts to conceal testing activity or evade security monitoring.
• Continued testing after sufficient evidence has been obtained or after SBAB has requested that testing stop.
• Other activities prohibited by this policy.

Safe Harbor applies only to authorization, claims and actions within SBAB's control.

It does not bind third parties, service providers, law enforcement authorities or other public authorities.

Nothing in this policy provides immunity from applicable law, guarantees protection from third-party claims or limits SBAB's legal or regulatory obligations.

Where a third party initiates legal proceedings concerning activities demonstrably conducted within the authorization granted by this policy, SBAB may confirm the scope of its authorization, where appropriate and legally permissible.

The limited authorization and commitments in this section are not negated by the general non-contractual nature of the policy.

If you are unsure whether an activity is permitted, contact sirt@sbab.se and obtain written authorization before proceeding.

12. Privacy

SBAB may process personal information included in vulnerability reports, including contact details, IP addresses, timestamps, technical logs, screenshots and related correspondence.

Such processing is carried out for the purposes of receiving, assessing, investigating, documenting and remediating reported security vulnerabilities and, where necessary, managing related security incidents or legal and regulatory obligations.

Depending on the purpose and circumstances of the processing, SBAB may rely on its legitimate interests in maintaining the security of its services or on applicable legal obligations, in accordance with the General Data Protection Regulation (GDPR) and Swedish law.

Vulnerability reports and related case documentation are normally retained for up to 12 months after a case has been closed, unless a longer retention period is required for legal, regulatory, security, incident-handling or other legitimate purposes.

Information forming part of a security incident investigation or other legally required record may be subject to separate retention requirements.

Researchers who wish to be publicly acknowledged may request inclusion in SBAB's Hall of Fame.

Participation is voluntary, and SBAB will not publish a researcher's name or other identifying information without appropriate authorization from the researcher.

Hall of Fame entries are normally retained for five years and may be removed earlier upon request, subject to applicable legal requirements.

More information about SBAB's processing of personal data, including data subject rights and how to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), is available in our privacy information.

13. Policy Updates and Contact

SBAB may periodically review and update this policy to reflect changes in its systems, security requirements, regulatory obligations or vulnerability disclosure processes.

Researchers should review the latest published policy before conducting any security testing.

For questions concerning this policy, authorized testing scope, vulnerability reporting or requests for additional written testing authorization, contact:

SBAB Security Incident Response Team (SIRT)

Email: sirt@sbab.se

Security contact: https://www.sbab.se/.well-known/security.txt